Minifilter Drivers and AMSI: Kernel-Adjacent Interception

Why kernel-adjacent, not kernel-resident

Latitude in the file system is largely decided by the minifilter altitude you request. Picking a sensible altitude lets you see the operation before the cache is populated while keeping the driver small enough to reason about.

Instrumenting AMSI

AMSI gives a supported seam into script and macro execution. Instrumenting it lets the agent observe intent — a decoded payload — rather than only the artefact that eventually lands on disk.

Verifying trust boundaries

PPL verification is the other half of the story. Knowing which processes are protected tells you where you are allowed to intervene and where you must instead observe.